admin.php

一款文件上传程序

<?php
define ( 'ADMIN', 1 );
require_once ( 'includes/commons.inc.php' );
$tpl_admin = new Template ( 'templates/' . $UPL['SETTINGS']['tpl'] . '/tpl_admin.php' );
$tpl_admin->set ( 'current_user', $UPL['USER']['username'] );

$allowed = $UPL['USER']['level'] == LEVEL_ADMIN || $UPL['USER']['level'] == LEVEL_MODERATOR;

if ( !$demo && !$allowed )
{
	$tpl_message->set ( 'message', 'You do not have the permission to access this page.' );
	$tpl_admin->setr ( 'content', $tpl_message, 1 );
	exit;
}


// multidimenional array search
function find_index ( &$array, $index, $value )
{
	while ( list ( $k, $v ) = each ( $array ) )
	{
		if ( $v[$index] == $value )
		{
			return $k;
		}
	}
	return false;
}

// get stats of a directory
function dir_stats ( $path, $result = array ( 'file_count' => 0, 'file_size' => 0, 'folder_count' => 0 ) )
{
	$h = @opendir ( $path );
	if ( !$h ) return $result;
	while ( false !== ( $f = readdir ( $h ) ) )
	{
		if ( $f != '.' && $f != '..' )
		{
			if ( is_file ( $path . '/' . $f ) )
			{
				$result['file_count']++;
				$result['file_size'] += filesize ( $path . '/' . $f );
			}
			else
			{
				$result['folder_count']++;
				$result = dir_stats ( $path . '/' . $f, $result );
			}
		}
	}
	closedir ( $h );
	return $result;
}

// display permission message
function display_message1 ( )
{
	global $tpl_admin, $tpl_message;

	$tpl_message->set ( 'message', 'Permission denied, you need to be an Admin.' );
	$tpl_message->set ( 'back_url', 'admin.php' );
	$tpl_admin->setr ( 'content', $tpl_message, 1 );
	exit;
}

function uksort_function ( $left, $right )
{
	return strtolower ( $left ) > strtolower ( $right );
}

// wut doing?
switch ( $action )
{
	// announcements
	case 'ann':
	{
		$tpl_ann = new Template ( TPL_DIR . 'tpl_announcements_admin.php' );
		$tpl_ann->setr ( 'task', $task );
		// read in old announcements
		$db = new DB;
		if ( !$db->open ( ANNOUNCEMENT_FILE ) )
		{
			exit ( 'Unable to open announcement file ' . ANNOUNCEMENT_FILE );
		}
		$ann = $db->all();
		reset ( $ann );
		$ann2 = array_reverse ( $ann );
		for ( $i = 0; $i < count ( $ann2 ); $i++ )
		{
			$ann2[$i]['view_url'] = 'admin.php?action=ann&amp;task=view&amp;id=' 	. $ann2[$i]['id'];
			$ann2[$i]['edit_url'] = 'admin.php?action=ann&amp;task=add&amp;id=' 	. $ann2[$i]['id'];
			$ann2[$i]['delete_url'] = 'admin.php?action=ann&amp;task=delete&amp;id=' . $ann2[$i]['id'];
			$ann2[$i]['moveup_url'] = 'admin.php?action=ann&amp;task=move&amp;direction=up&amp;id=' . $ann2[$i]['id'];
			$ann2[$i]['movedown_url'] = 'admin.php?action=ann&amp;task=move&amp;direction=down&amp;id=' . $ann2[$i]['id'];
		}
		$tpl_ann->setr ( 'ann', $ann2 );

		// wut doing?
		switch ( $task )
		{
			case 'move':
			{
				$direction = gpc ( 'direction', 'G', 'up' );
				$id = gpc ( 'id', 'G', 0 );
				$i = find_index ( $ann, 'id', $id );
				if ( $id && $i !== false )
				{
					if ( $direction == 'down' && $i > 0 )
					{
						$temp = $ann[$i];
						$ann[$i] = $ann[$i-1];
						$ann[$i-1] = $temp;
						$db->set($ann,true);
						$db->save();
					}
					elseif ( $direction == 'up' && $i < ( count ( $ann ) - 1 ) )
					{
						$temp = $ann[$i];
						$ann[$i] = $ann[$i+1];
						$ann[$i+1] = $temp;
						$db->set($ann,true);
						$db->save();
					}
				}
				header ( 'Location: admin.php?action=ann' );
			}
			break;

			case 'delete':
			{
				if ( $demo ) exit ( "Demo only!" );
				$id = gpc ( 'id', 'G', 0 );
				$i = find_index ( $ann, 'id', $id );

				if ( $id && $i !== false  && isset ( $ann[$i] ) )
				{
					unset ( $ann[$i] );
					$ann = array_values ( $ann );
					$db->set($ann,true);
					$db->save();
				}
				header ( 'Location: admin.php?action=ann' );
			}
			break;

			case 'add':
			{
				// might be edit
				$id = gpc ( 'id', 'G', 0 );
				$i = find_index ( $ann, 'id', $id );

				if ( $id && $i !== false )
				{
					$ann[$i]['content'] = htmlentities ( $ann[$i]['content'] );
					$ann[$i]['id'] = $id;
					$tpl_ann->setr ( 'edit_ann', $ann[$i] );
				}
				else
				{
					$tpl_ann->set ( 'edit_ann', array ( 'title' => '', 'content' => '', 'id' => '', 'parse_bb' => true, ) );
				}

				$tpl_admin->setr ( 'content', $tpl_ann );
				$tpl_admin->display ( );
			}
			break;

			case 'doadd':
			{
				if ( $demo ) exit ( 'Demo only!' );
				$new_ann = isset ( $_POST['new_ann'] ) ? $_POST['new_ann'] : array ( );
				$new_ann['parse_bb'] = isset ( $new_ann['parse_bb'] ) ? (bool)$new_ann['parse_bb'] : false;
				if ( count ( $new_ann ) )
				{
					if ( $new_ann['title'] == '' || $new_ann['content'] == '' )
					{
						$tpl_message->set ( 'message', 'Please fill out both the title and message fields.' );
						$tpl_message->set ( 'back_url', 'javascript:history.go(-1);' );
						$tpl_uploader->set ( 'content', $tpl_message );
						exit ( $tpl_uploader->display ( ) );
					}
					// if it's an edit, replace old announcement, otherwise just add it
					$i = find_index ( $ann, 'id', $new_ann['id'] );

					if ( $i === false )
					{
						// new ann
						$new_ann['time'] = time ( );
						$new_ann['id'] = $new_ann['time'];
						// posted by...
						$new_ann['userid'] = $UPL['USER']['id'];
						$new_ann['username'] = $UPL['USER']['name'];
						// add it
						$ann [] = $new_ann;
					}
					else
					{
						// an edit
						$ann[$i]['parse_bb'] = isset ( $new_ann['parse_bb'] ) ? (bool)$new_ann['parse_bb'] : false;
						$ann[$i]['title'] = $new_ann['title'];
						$ann[$i]['content'] = $new_ann['content'];
					}

					$db->set($ann,true);
					$db->save();
				}
				header ( 'Location: admin.php?action=ann' );
			}

			case 'view':
			{
				$id = gpc ( 'id', 'G', 0 );
				$k = find_index ( $ann, 'id', $id );
				if ( $id && $k !== false )
				{
					$cur_ann = $ann[$k];
					$cur_ann['time'] = date ( $UPL['CONFIGS']['TIME_FORMAT'], $cur_ann['time'] );
					$cur_ann['content'] = str_replace ( '  ', ' &nbsp;', nl2br ( $cur_ann['content'] ) );
					$tpl_ann->setr ( 'cur_ann', $cur_ann );
					$tpl_admin->setr ( 'content', $tpl_ann );
					$tpl_admin->display ( );
				}
			}
			break;

			default:
			{
				$tpl_admin->setr ( 'content', $tpl_ann );
				$tpl_admin->display ( );
			}
			break;
		}
	}
	break;

	// uploader settings
	case 'settings':
	{
		if (!$demo &&  $UPL['USER']['level'] != LEVEL_ADMIN ) display_message1 ( );
		if ( $task == 'save' )
		{
			if ( $demo ) exit ( 'Demo only!' );
			$error = 'none';
			$psettings =& $_POST['settings'];
			$settings = array
			(
				'uploader_url'  => trim ($psettings['uploader_url']),
				'uploader_view' => isset($psettings['uploader_view']) ? (int)$psettings['uploader_view'] : 0,
				'userfiles_dir' => trim($psettings['userfiles_dir']),
				'userfiles_url' => trim($psettings['userfiles_url']),
				'reg'           => isset($psettings['reg'])?(int)$psettings['reg'] : 0,
				'regmsg'		=> trim($psettings['regmsg']),
				'm'				=> isset($psettings['m'])?(int)$psettings['m']:0,
				'm_msg'			=> trim($psettings['m_msg']),
				'approval'      => isset($psettings['approval']) ? (int)$psettings['approval'] : 0,
				'activation_req'=> isset($psettings['activation_req'] ) ? (int)$psettings['activation_req'] : 0,
				'browsing'      => trim($psettings['browsing']),
				'filetypes'     => strtolower(trim ( $psettings['filetypes'], ', ')),
				'email'         => trim($psettings['email']),
				'notify_reg'    => isset($psettings['notify_reg'])?(int)$psettings['notify_reg']:0,
				'log'           => isset($psettings['log'])?(int)$psettings['log']:0,
				'tpl'           => trim($psettings['tpl']),
				'wm'			=> trim($psettings['wm']),
				'wm_path'		=> trim($psettings['wm_path']),
			);

			if ( !is_dir ( $settings['userfiles_dir'] ) )
			{
				$error = "User files '{$settings['userfiles_dir']}' does not exist.";
			}
			elseif ( !is_file ( $settings['wm_path'] ) )
			{
				$error = "Watermark file '{$settings['wm_path']}' does not exist.";
			}
			elseif ( !is_dir ( 'templates/' . $settings['tpl'] ) )
			{
				$error = "Template '{$settings['tpl']}' does not exist.";
			}

			if ( $error == 'none' )
			{
				// save
				$db = new DB;
				if ( !$db->open ( UPLOADER_SETTINGS ) ) exit ( 'Unable to open settings file ' . UPLOADER_SETTINGS );
				$db->set ( $settings, 1 );
				$db->save ( );
				header ( 'Location: admin.php?action=settings&saved' );
			}
			else
			{
				$tpl_message->set ( 'message', $error );
				$tpl_message->set ( 'back_url', 'admin.php?action=settings' );
				$tpl_admin->set ( 'content', $tpl_message, 1 );
			}
		}
		else
		{
			$tpl_settings = new Template ( TPL_DIR . 'tpl_settings.php' );
			$tpl_settings->set ( 'action', $action );
			$tpl_settings->setr ( 'settings', $UPL['SETTINGS'] );

			$tpl_settings->set ( 'uploader_absolute_path', dir_name ( __FILE__ ) );


			$tpl_admin->set ( 'page_title', 'Uploader Settings' );
			$tpl_admin->setr ( 'content', $tpl_settings );
			$tpl_admin->display ( );
		}
	}
	break;

	// user settings
	case 'user_settings':
	{
		if (!$demo &&  $UPL['USER']['level'] != LEVEL_ADMIN ) display_message1 ( );
		$db = new DB;
		if(!$db->open(USER_SETTINGS))
		{
			exit ( 'Unable to open default user settings file for reading at ' . USER_SETTINGS );
		}

		if ( $task == 'save' )
		{
			if ( $demo ) exit ( 'Demo only!' );
			$psettings = isset ( $_POST['settings'] ) ? $_POST['settings'] : exit ( 'Settings expected in POST data' );
			// clean up inputs
			$psettings2 = array
			(
				'fl_max_storage'	 => (float)$psettings['fl_max_storage'],
				'fl_max_filesize'	 => (float)$psettings['fl_max_filesize'],
				'fl_max_folders'	 => (float)$psettings['fl_max_folders'],
				'fl_allowed_filetypes'	 => strtolower ( trim ( $psettings['fl_allowed_filetypes'], ' ,' ) ),
				'fl_images_only'	 => (bool)$psettings['fl_images_only'],
				'fl_allow_rename'	 => (int)( $psettings['fl_allow_rename'] ),
				'fl_create_folder'	 => (bool)$psettings['fl_create_folder'],
				'fl_watermark'		 => (bool)$psettings['fl_watermark'],
				'bw_auto_reset'		 => (bool)$psettings['bw_auto_reset'],
				'bw_max'		 => (float)$psettings['bw_max'],
				'bw_reset_period'	 => (float)$psettings['bw_reset_period'],
				'bw_xfer_rate'		=> (int)$psettings['bw_xfer_rate'],
			);
			$restrictions = array
			(
				'name_min_len'		=> (int)$psettings['name_min_len'],
				//'name_max_len'		=> (int)$psettings['name_max_len'],
				'name_max_len'		=> MAX_USERNAME_LEN,
				'disallowed_names'	=> strtolower ( trim ( $psettings['disallowed_names'], ' ,' ) ),
			);
			//save

			$db->set('new_user_settings', $psettings2);
			$db->set('restrictions', $restrictions );
			$db->save();
			header ( 'Location: admin.php?action=user_settings&saved' );
		}
		else
		{
			$settings = array_merge ( $db->get('new_user_settings'), $db->get ( 'restrictions' ) );
			$tpl_settings = new Template ( TPL_DIR . 'tpl_settings.php' );
			$tpl_settings->set ( 'action', $action );
			$tpl_settings->set ( 'saved', isset ( $_GET['saved'] ) );
			$tpl_settings->setr ( 'settings', $settings );
			$tpl_admin->set ( 'page_title', 'New User Settings' );
			$tpl_admin->setr ( 'content', $tpl_settings );
			$tpl_admin->display ( );
		}
	}
	break;

	// public settings
	case 'public':
	{
		if ( $task == 'save' )
		{
			$psettings = gpc ( 'psettings', 'P', array ( ) );

			if ( is_array ( $psettings ) && count ( $psettings ) )
			{